v2.9.1

Fixed

• Management UI OAuth2 login now works with identity providers that require a specific scope (e.g. Entra ID), via the new mgmt_scopes config option #2127
• Accept JWKS keys that omit the alg parameter when fetching keys for OAuth/OIDC #2124
• Document that OAuth/OIDC JWTs must include a kid header matching a JWKS key #2107
• Enforce policymaker role checks on the shovel management endpoints #2133
• Apply SNI certificate changes on config reload #2129
• Stream cleanup_consumer_offsets overflow when the consumer_offsets file is near full #1995
• Clustered localhost listener bind failures during startup #2114
• Heartbeat frames on non-zero channels now close the connection with UNEXPECTED_FRAME #1999
• Normalize IPv4-mapped peer addresses in connection metadata, logs and API fields #2122

Changes: v2.9.0...v2.9.1